Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2020-11976GHSA-64GV-3PQV-299H

By crafting a special URL it is possible to make Wicket deliver unprocessed HTML templates.

Published
Last modified
published
Not listed in CISA KEV
Fix
Fixed in 7.17.0, 8.9.0, 9.0.0
None on Exploit-DB, Metasploit or GitHub

Summary

By crafting a special URL it is possible to make Wicket deliver unprocessed HTML templates. This would allow an attacker to see possibly sensitive information inside a HTML template that is usually removed during rendering. Affected are Apache Wicket versions 7.16.0, 8.8.0 and 9.0.0-M5

Timeline

  1. CVE published
  2. Record last updated

Affected versions

  • n/a Apache Wicket

    Version range not reported

  • org.apache.wicket:wicket-coreMaven

    fixed in 7.17.0

  • org.apache.wicket:wicket-coreMaven

    From 8.0.0 · fixed in 8.9.0

  • org.apache.wicket:wicket-coreMaven

    From 9.0.0-M1 · fixed in 9.0.0

  • org.apache.wicket:wicket-coreMaven

    From 9.0.0-M2 · fixed in 9.0.0

  • org.apache.wicket:wicket-coreMaven

    From 9.0.0-M3 · fixed in 9.0.0

  • org.apache.wicket:wicket-coreMaven

    From 9.0.0-M4 · fixed in 9.0.0

  • org.apache.wicket:wicket-coreMaven

    From 9.0.0-M5 · fixed in 9.0.0

References 8

lists.apache.org